Science & Tech · Cybersecurity · 2 hrs ago
Malicious Claude Code extension exposed up to 5,000 Cursor users
A tampered Claude Code extension reached Cursor’s marketplace on October 29 and was available for about 11 hours.
Claude Code is Anthropic’s AI coding assistant, and Cursor is a code editor that supports extensions made for Visual Studio Code.
Up to 5,000 developers may have been exposed to the malicious version, numbered 2.1.313.
The malware collected details such as usernames, Git email addresses and public IP addresses, and tried to install a persistent SSH backdoor.
The backdoor may have failed on many machines because of errors in its setup, but the malware could still send device information and leave files or settings behind.
Anthropic said its systems and employees’ laptops were not compromised, and that the malicious copy was not built or published by the company.
Cursor removed the extension and shut down its marketplace temporarily while checking other extensions, rotating its keys and working to block the attacker’s server.
Developers who installed it should follow Cursor’s cleanup guidance, because installing the latest version alone may not remove the infection.
A malicious version of Anthropic’s Claude Code extension was available on Cursor’s marketplace for about 11 hours on October 29.
The compromised extension could collect information about developers’ machines and install persistent SSH access mechanisms.
Up to 5,000 developers may have been exposed, although errors in the malware likely prevented remote access on many Windows and macOS systems.
Cursor removed the extension, temporarily shut down its marketplace, rotated access keys and worked with a hosting provider to block the attacker’s server.
Anthropic said its systems and employee laptops were not compromised and that the malicious extension was not built or published by the company.
- Who
- Cursor users who downloaded the malicious Claude Code extension were potentially affected.
- What
- A tampered extension collected host and user information and attempted to install persistent SSH backdoors.
- When
- It was available for about 11 hours on October 29, 2026.
- Where
- Cursor’s VS Code extension marketplace.
- Why
- A malicious actor used access to Cursor’s marketplace to publish the tampered extension. The attacker’s motive is not stated.
This story does not have two clearly opposing sides.
The malicious extension, version 2.1.313, was available in Cursor’s marketplace for about 11 hours.
Cursor removed the extension and temporarily shut down its VS Code marketplace.
Cursor checked other extensions, rotated its keys and worked with a hosting provider to block the attacker’s server.
- Affected version
- 2.1.313
- Exposure window
- About 11 hours
- Potentially exposed
- Up to 5,000 developers
- Marketplace
- Cursor’s VS Code extension marketplace
- Attacker server
- 134.209.82[.]225
3 sources
What people are saying
A malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension, which we didn't build or publish.
The extension runs malicious code that attempts to install a persistent SSH backdoor.
We removed the malicious version from the marketplace immediately upon detection and blocked further distribution.
Posts on X
We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our